var a = [1];
a.length = 1000;

var o = {};
  Object.defineProperty(o, '1', {
    get: function() {
      for (var i = 0; i < 0x100000; i++) {
          a[0x100000 + i] = i; 
      }
      return 2;
    }
  });

a.__proto__ = o;

var r = [].reverse.call(a);
